XK0-006 Multiple Select — 60 Questions

Question 1

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Option D is correct because setting PermitRootLogin no in /etc/ssh/sshd_config prevents direct root logins over SSH, forcing attackers to compromise a normal user account first and eliminating the most privileged and commonly brute-forced target. Option E is correct because setting PasswordAuthentication no disables password-based authentication entirely, so only SSH key pairs are accepted, which defeats brute-force and credential-guessing attacks since keys cannot be feasibly guessed. The unmarked options do not belong: PermitRootLogin yes (A) explicitly allows direct root SSH access, the opposite of hardening; PasswordAuthentication yes (B) keeps password logins enabled and thus brute-forceable; and disabling the SSH service (C) would block legitimate remote administration rather than secure it, which is not a practical hardening action for a server that must be administered remotely.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 2

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. rkhunter (B) is a dedicated rootkit hunter that scans for known rootkit signatures, suspicious files, and hidden processes on Linux, making it specifically designed for rootkit detection. chkrootkit (E) is likewise a purpose-built tool that checks system binaries and common rootkit infection vectors on Linux. By contrast, lsof (A) only lists open files and associated processes, netstat (C) merely displays network connections and routing tables, and clamav (D) is an antivirus scanner targeting malware such as viruses and trojans rather than rootkits specifically, so none of these are specifically designed for rootkit detection.

Answer

lsof

Answer

netstat

Answer

clamav

Question 3

Which TWO of the following are valid methods for debugging a Bash script? (Choose TWO.)

Accepted Answer

Run the script with 'bash -x script.sh'. Running 'bash -x script.sh' enables an execution trace that prints each command and its arguments to stderr before executing it, which is a standard debugging method for Bash scripts. Option C is correct because adding 'set -x' at the start of the script achieves the same trace output, but from within the script itself, allowing granular control over which sections are traced.

Answer

Add 'set -r' to restrict shell

Answer

Run the script with 'bash -d script.sh'

Answer

Add 'set -n' to check syntax

Question 4

Which TWO commands can be used to change the group ownership of a file? (Choose exactly two.)

Accepted Answer

chgrp. Option B (chgrp) is correct because chgrp is the dedicated command for changing a file's group ownership, e.g. 'chgrp developers file.txt' sets the group of file.txt to developers. Option D (chown) is correct because chown can also change group ownership using the ':group' or '.group' syntax, e.g. 'chown :developers file.txt' or 'chown user:developers file.txt'. Option A (chmod) is incorrect because it modifies read/write/execute permission bits (and special bits like setgid), not the owning group itself. Option C (groupmod) is incorrect because it modifies attributes of an existing group in /etc/group, such as its name or GID, not a file's group ownership. Option E (usermod) is incorrect because it modifies user account attributes such as group membership, home directory, or shell, not file ownership.

Answer

chmod

Answer

groupmod

Answer

usermod

Question 5

A system administrator is writing a Bash script that must check if a file exists and is readable. Which two test expressions can be used to achieve this? (Choose two.)

Accepted Answer

-e /path/to/file. Option A, `-e /path/to/file`, is correct because the `-e` test in Bash returns true if the file exists, regardless of its type (regular file, directory, device, etc.), which satisfies the existence check. Option C, `-r /path/to/file`, is correct because the `-r` test returns true if the file exists and the current user has read permission on it, satisfying the readability check. Together, `-e` and `-r` cover the two required conditions of existence and readability. Option B, `-s`, only checks that the file exists and has a size greater than zero, so it does not verify readability. Option D, `-x`, checks for execute permission rather than read permission, so it does not meet the requirement. Option E, `-f`, only checks that the path exists and is a regular file, not that it is readable.

Answer

-s /path/to/file

Answer

-x /path/to/file

Answer

-f /path/to/file

Question 6

A server crashed with a kernel panic. After reboot, the administrator wants to analyze the crash dump. Which THREE actions should be taken to ensure a valid core dump is captured and accessible? (Choose THREE.)

Accepted Answer

Configure a dump target in /etc/kdump.conf.. Option A is correct because /etc/kdump.conf is the kdump configuration file where you must specify the dump target (e.g., a raw device, path, NFS, or SSH location) so the vmcore is written to a persistent, accessible location after the crash. Option B is correct because the kdump service (kdump.service) must be enabled and started so the kdump initramfs is loaded and the capture mechanism is armed for the next kernel panic. Option C is correct because the crashkernel=auto (or an explicit size like crashkernel=256M) kernel parameter in the boot loader reserves memory for the secondary kernel that performs the dump; without it, no dump can be captured. Option D is not required to capture a dump; kernel-debuginfo is only needed later for analyzing the vmcore with tools like crash. Option E is incorrect because /var/crash/vmcore is the result of a successful capture, not an action taken to ensure one, and its presence cannot be guaranteed before a crash occurs.

Answer

Install kernel-debuginfo packages.

Answer

Ensure /var/crash has a vmcore file.

Question 7

A system administrator is working with compressed files. Which THREE commands can be used to view their contents? (Select THREE).

Accepted Answer

zgrep. Option A, zgrep, is correct because it searches inside gzip-compressed files directly, decompressing the stream on the fly and printing matching lines without requiring manual extraction. Option C, zcat, is correct because it decompresses gzip files to standard output, allowing their contents to be viewed (often piped to a pager). Option E, zless, is correct because it is a pager wrapper that decompresses gzip files and displays them page by page, making it ideal for viewing compressed content interactively. Options B (cat) and D (less) are not marked correct because they operate on plain uncompressed files and would output raw binary garbage when applied directly to a gzip-compressed file.

Answer

cat

Answer

less

Question 8

A Linux server is experiencing intermittent connectivity issues. The administrator reviews the system logs and finds the following messages: 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out'. Which THREE actions are likely to resolve this issue? (Choose three.)

Accepted Answer

Disable NIC offloading features using 'ethtool -K eth0 tx off sg off'.. The 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out' error often indicates that the NIC's hardware offloading features (such as TCP segmentation offload, scatter-gather) are causing the driver to hang or fail to complete transmissions. Disabling these offloads with 'ethtool -K eth0 tx off sg off' forces the CPU to handle packet segmentation and reduces the load on the NIC, which can resolve the timeout.

Answer

Increase the transmit queue length using 'ifconfig eth0 txqueuelen 10000'.

Answer

Change the MTU on the interface to 9000.

Question 9

Which TWO statements are true regarding the use of Ansible for automation? (Choose TWO.)

Accepted Answer

Ansible playbooks are written in YAML.. Option B is correct because Ansible playbooks are defined in YAML, a human-readable data serialization format that describes tasks, plays, and roles executed by the Ansible engine. Option C is correct because Ansible is agentless: it does not require any software installed on managed nodes and communicates over standard SSH (or WinRM for Windows hosts) to push modules and execute tasks. Option A is incorrect because Ansible can run from any control machine, including a laptop or a CI runner, and does not mandate a dedicated master server. Option D is incorrect because Ansible uses a push-based model, where the control node pushes playbooks/modules to targets, not a pull model like Puppet or Chef agents. Option E is incorrect because Ansible modules are written in Python (or any language returning JSON), not Ruby.

Answer

Ansible requires a dedicated master server to manage nodes.

Answer

Ansible uses a pull-based model where nodes fetch configurations from a central server.

Answer

Ansible modules are written in Ruby.

Question 10

A security team wants to implement mandatory access control (MAC) on a Linux server to confine a potentially vulnerable daemon. Which TWO of the following technologies can be used for this purpose?

Accepted Answer

AppArmor. AppArmor (B) is a Linux Security Module that enforces mandatory access control by applying per-program profiles that restrict a daemon's file, network, and capability access, so it directly confines a vulnerable service. SELinux (C) is likewise an LSM implementing MAC through type enforcement, roles, and security contexts, and it is commonly used to sandbox daemons on Linux servers. Both are kernel-level MAC frameworks, which is exactly what the scenario requires. sudo (A) is only a privilege-delegation tool for running commands as another user and does not enforce MAC confinement. TCP wrappers (D) provide host-based access control for network services via hosts.allow/hosts.deny, not mandatory access control. iptables (E) is a packet-filtering firewall that controls network traffic, not process-level mandatory access control.

Answer

sudo

Answer

TCP wrappers

Answer

iptables

Question 11

A DevOps team uses Podman to run containers rootlessly. Which TWO of the following characteristics apply to rootless Podman compared to Docker? (Select TWO).

Accepted Answer

It uses the same CLI syntax as Docker. Podman does not require a daemon (no central daemon), and it can run containers without root privileges by default using user namespaces.

Answer

It can only run containers as root

Answer

It requires a running daemon at all times

Answer

It relies on a central registry for all images

Question 12

A system administrator wants to encrypt a large directory of files using GPG with a symmetric cipher. Which two steps are necessary? (Select TWO).

Accepted Answer

Use a passphrase to encrypt. Symmetric encryption in GPG requires a passphrase to derive the encryption key. When using `gpg --symmetric`, the cipher key is generated from a passphrase provided by the user, making the passphrase the essential secret for both encryption and decryption. Without a passphrase, symmetric encryption cannot proceed.

Answer

gpg --decrypt file.gpg

Answer

gpg --encrypt --recipient user file

Answer

Import a public key

Question 13

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Accepted Answer

Configure pam_faillock.so to lock accounts after failed attempts. Option B is correct because configuring pam_faillock.so in the PAM stack enforces account lockout after a defined number of failed authentication attempts (e.g., deny=5, unlock_time=900), directly mitigating brute-force and password-guessing attacks against the weak password policy. Option C is correct because pam_pwquality.so enforces password complexity requirements such as minimum length (minlen), character classes (ucredit, lcredit, dcredit, ocredit), and dictionary checks, which addresses the audit finding of weak password policies at their source. Option D is correct because setting PasswordAuthentication no in sshd_config disables password-based SSH authentication entirely, forcing key-based authentication and eliminating the password-guessing attack surface the audit flagged; this requires reloading sshd (systemctl reload sshd) to take effect. Option A does not belong because merely changing the SSH port to 2222 is security through obscurity and does not fix the underlying weak authentication or password policy issues. Option E does not belong because setting PermitRootLogin yes permits direct root logins over SSH, which increases risk rather than improving security; it should be set to no or prohibit-password.

Answer

Change SSH port to 2222

Answer

Set PermitRootLogin yes

Question 14

Which TWO commands can be used to display the current kernel version on a Linux system?

Accepted Answer

uname -r. Option B, uname -r, is correct because the uname command prints system information and the -r flag specifically outputs the kernel release (version) string, such as 5.15.0-91-generic. Option C, cat /proc/version, is correct because /proc/version is a virtual file exposed by the kernel that contains the kernel version, gcc version used to build it, and build timestamp. Option A, modinfo, is incorrect because it displays metadata about a specific kernel module (e.g., filename, license, parameters), not the running kernel version. Option D, lsmod, is incorrect because it lists currently loaded kernel modules by reading /proc/modules, not the kernel version. Option E, dmesg, is incorrect because it prints the kernel ring buffer messages, which may mention the version incidentally but is not a command designed to display the current kernel version.

Answer

modinfo

Answer

lsmod

Answer

dmesg

Question 15

A system administrator needs to monitor system performance over time. Which THREE tools can be used to collect and display CPU, memory, and I/O statistics? (Choose three.)

Accepted Answer

iostat. iostat (A) is correct because it is part of the sysstat package and reports CPU utilization along with per-device and per-partition I/O statistics such as tps, kB_read/s, and kB_wrtn/s, making it ideal for collecting and displaying I/O and CPU data over time. sar (C) is correct because the System Activity Reporter, also from sysstat, records and replays historical CPU, memory, and I/O metrics via cron-collected binary files (e.g., /var/log/sa/saXX) using options like -u, -r, and -b, which directly supports monitoring performance over time. vmstat (D) is correct because it reports virtual memory, CPU, and I/O statistics including processes (r, b), swap (si, so), memory (free, buff, cache), and block I/O (bi, bo) at specified intervals, allowing ongoing collection and display of the required metrics. top (B) is not among the marked answers because although it displays CPU and memory in real time, it is an interactive process viewer rather than a tool designed to collect and persist statistics over time, and it lacks dedicated I/O reporting. htop (E) is likewise excluded because it is an interactive process monitor similar to top and does not provide the historical data collection or detailed I/O statistics that the scenario requires.

Answer

top

Answer

htop

Question 16

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Option B is correct because appending 'single' (or '1') to the kernel command line in GRUB boots the system into single-user/rescue mode, which starts a root shell without requiring the normal login and is a standard recovery method. Option D is correct because appending 'rd.break' to the kernel command line interrupts the boot process in the initramfs (dracut) before the root filesystem is mounted, dropping the administrator into a root shell where the real root can be mounted and repaired. Option E is correct because booting from a live CD/USB and then chrooting into the installed system's root filesystem gives a root shell with access to the broken system's files and tools, allowing repairs such as reinstalling GRUB or fixing /etc/fstab. Option A is incorrect because 'fsck /dev/sda1' is not a valid GRUB command-line operation for obtaining a root shell; GRUB's command line is for bootloader commands, not for running filesystem checks as a recovery shell. Option C is incorrect because pressing 'e' in GRUB only opens the menu entry for editing and removing 'quiet' merely changes console verbosity; it does not by itself provide a root shell.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 17

A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)

Accepted Answer

Attackers can obtain usernames easily.. Option B is correct because /etc/passwd contains one line per account with the username in the first colon-separated field, so a world-readable file lets attackers enumerate valid local usernames for brute-force or phishing attacks. Option C is correct because the sixth field of each /etc/passwd entry holds the user's home directory path, exposing directory layout that aids targeted attacks on user files or SSH keys. Option D is correct because the third field contains the numeric UID and the fourth field the primary GID, so attackers learn the UID-to-username mapping needed to craft privilege-escalation or file-ownership exploits. Option A is not correct because modern /etc/passwd stores an 'x' placeholder in the password field, not the encrypted password itself. Option E is likewise not correct because password hashes are kept in the shadowed /etc/shadow file, which is not world-readable.

Answer

Attackers can read the encrypted passwords.

Answer

Attackers can read password hashes.

Question 18

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Accepted Answer

visudo. Option B (visudo) is correct because it is the designated command for safely editing the sudo policy: it locks the sudoers file against concurrent edits, performs syntax checking before saving, and prevents a corrupt sudoers file from breaking sudo access. Option D (/etc/sudoers) is correct because it is the primary sudo policy file that defines which users and groups may run which commands as which target users, so reviewing and modifying excessive sudo privileges requires examining and changing this file. The unmarked options do not belong: chage (A) manages password aging fields such as -M, -m, and -W, not sudo rights; usermod -G (C) changes a user's supplementary group memberships, which only indirectly affects sudo if those groups are referenced in sudoers; and /etc/group (E) lists group memberships but contains no sudo command-authorization rules.

Answer

chage

Answer

usermod -G

Answer

/etc/group

Question 19

An administrator needs to create a hard link to an existing file. Which two statements are true about hard links? (Choose two.)

Accepted Answer

Hard links are indistinguishable from the original file. Option C is correct because a hard link is simply another directory entry that points to the same inode, so it has identical permissions, ownership, timestamps, and content as the original file and cannot be distinguished from it by normal file operations. Option D is correct because creating a hard link with ln (without -s) increments the inode's link count and gives the new name the same inode number as the original file, which is why both names reference the same data blocks. Option A is wrong because hard links to directories are prohibited on Linux filesystems to prevent cycles in the directory tree. Option B is wrong because a hard link must reside on the same filesystem as the target file, since inode numbers are only unique within a single filesystem. Option E is wrong because deleting the original name only decrements the link count; the data remains accessible through the remaining hard link until the link count reaches zero.

Answer

Hard links can be created for directories

Answer

Hard links can be created across different filesystems

Answer

Deleting the original file removes the hard link

Question 20

Which TWO statements about container security are correct when using Docker? (Choose two.)

Accepted Answer

Using --cap-drop=ALL removes all capabilities, making the container more secure.. Option C is correct because Docker's --cap-drop=ALL flag removes every Linux capability from the container's process, leaving it with none of the privileged operations (such as CAP_NET_RAW or CAP_SYS_ADMIN) that a compromised process could abuse, which strictly reduces the attack surface. Option D is correct because Docker's default capability set is already a reduced subset of the full root capability list — it drops dangerous capabilities like CAP_SYS_ADMIN and CAP_SYS_MODULE while retaining a limited set such as CAP_CHOWN, CAP_NET_BIND_SERVICE, and CAP_SETUID. Option A is wrong because SELinux is a host-level mandatory access control mechanism that is not automatically enabled inside containers; container processes are confined by the host's SELinux policy only if SELinux is enabled and configured on the host. Option B is wrong because containers share the host's kernel and use namespaces and cgroups for isolation rather than having their own kernel, unlike virtual machines. Option E is wrong because --network=host removes network namespace isolation, causing the container to share the host's network stack and thus decreasing, not increasing, isolation.

Answer

SELinux is automatically enabled inside containers.

Answer

Containers have their own kernel, isolated from the host.

Answer

Using --network=host increases container isolation.